In information technology (IT) and networking, the word “Bot” is derived from “robot” and refers to an automated process that interacts with other network elements. Bots may be configured to automate tasks that would otherwise be conducted by a human being. A growing problem is the use of Bots by malicious entities to attack and gain unauthorized access to network-connected computers and other network resources via the Internet.
One type of Bot process may initially run on a computer controlled by the malicious entity. It may probe victim networks and computers for vulnerabilities, and upon finding such, exploits them to access information, often personal information of individuals stored in computers. A Bot may install a program known as “malware” on a victim computer merely for the malicious purpose of randomly displaying rude messages or perhaps even damaging the victim's file system. The malware program may then perform one or more automated processes, which itself may be a type of Bot.
In recent years, Bot exploits have become much more sophisticated and financially rewarding for the malicious entities. For example, the modern Bots may be programmed to access the victim's computer and surreptitiously access certain websites and click on advertisements that are displayed there. In “pay per click” type advertising, each click from a potential buyer generates revenue for the displaying website. Thus, clicks generated by the Bot could create undeserved revenue for the displaying website. In the art, this is called “click-fraud.”
The problem is greatly compounded by the fact that Bots on a victim's computer may be programmed to probe the network for additional victims, and install itself on their computers. Victims on the same local network as the first victim computer may be particularly vulnerable, because they may exist behind any corporate firewall or intrusion detection system designed to protect against Bots or malware. This is because many local computers are often addressed privately and may not be visible outside the corporate firewall, but can be readily accessed by other local computers. Also, local computers may erroneously assume that communications from other local computers are benign. Thus, once one local computer is infected, the number of infected computers may increase significantly.
Bots that have been installed on victim computers may maintain communication with what is known in the art as a Command and Control facility (“C&C”) operated by the malicious entity. A collection of such Bots is known in the art as a “Botnet” and has the potential to cause widespread damage, which may not even be evident to victim computer systems. Click fraud is an example that can go unseen initially. If a large Botnet were programmed to cause widespread click fraud, it could potentially generate a significant number of clicks from a diverse set of fraudulent buyers, causing substantial adverse economic impact. A large Botnet could also be used to cause a large amount of spurious traffic to overwhelm and shut down a targeted website. This is known in the art as a “distributed denial-of-service attack.”
Besides trying to keep Bots out of a local network, conventional security systems also focus on trying to detect the presence of Bots on infected computers within the local network. One way to do this is to analyze the behavior of a known-infected computer, and generate a “signature” according to a “schema” to summarize the behavior of the Bot. A schema is a multi-element template for summary information, and a signature is a schema that is populated with a particular set of values. A detailed example is given later. Typically such a schema and signature would be created by the security company that is protecting the local network, distributed to customers, and then used by anti-virus, anti-malware software installed on each computer in the customer's network to fight off known Bots. However, the usefulness of this approach is limited, because the ability for any anti-malware or anti-virus software operating on any single local computer to ascertain the number of details in and the sophistication of the schema and signature is limited by what can be observed. Also, this approach is typically not effective against attacks early in the lifetime of a new Bot, known in the art as “Zero-Day Attacks”, because developers of the anti-malware and anti-virus software do not have the opportunity or time to create a corresponding schema and signature for a new Bot.
Honeypots are known in the art as counter deceptive decoy systems that may be deployed along with production systems to distract attackers such as Bots from particular targets, luring attacker/hackers away in order to observe and learn the malicious behavior in a controlled environment as well as to trap the attackers.
A Honeypot appears to an attacker to be a legitimate, active component of the network containing information or resources that would be valuable to attackers, but is actually isolated and monitored. The idea is similar to the police baiting a criminal and then doing undercover surveillance.
So-called research Honeypots can capture a lot of information about specific, known threats, but are complex and expensive to deploy and maintain, and are therefore used primarily by research, military, or government organizations. In a production network, it is simpler and more economical to deploy a low-interaction Honeypot, but such a Honeypot typically can collect much less information about an attack and its lifecycle, and may be ineffective at identifying and characterizing Zero-Day Attacks. A production Honeypot, even with high interaction, may be designed more to waste the attacker's time that to analyze and characterize its behavior and share the detailed characterization with a larger community.
As will be seen, the systems and methods described herein address shortcomings such as these in an elegant manner, by providing a highly structured, distributed, and extensible means for constructing very detailed characterizations of attack behaviors and for sharing such characterizations within a local network and beyond